POINT COUNTING ON REDUCTIONS OF CM ELLIPTIC 

CURVES 



K. RUBIN AND A. SILVERBERG 



Abstract. We give explicit formulas for the number of points on reductions 
of elliptic curves with complex multiplication by any imaginary quadratic field. 
We also find models for CM Q-curves in certain cases. This generalizes earlier 
results of Gross, Stark, and others. 



1. Introduction 

In this paper we give explicit formulas for the number of points on reductions 
of CM elliptic curves (see Theorems 11.11 and 15.31 and Corollary 15. 4p . We also give 
models for CM Q-curves, in certain cases (see Theorem 17. 4p . 

If E is an elliptic curve over a finite field V q , it is well-known that to count the 
number of points in E(¥ q ), it suffices to determine the Frobenius endomorphism of 
E over F q , or more precisely the trace of Frobenius acting on an appropriate vector 
space. The best methods known for accomplishing this with a general elliptic curve 
are modifications of the method of Schoof \±7\ [18] or p-adic methods [15] . 

When E is the reduction of an elliptic curve E over a number field F with 
complex multiplication (CM) by an order in an imaginary quadratic field K C F ', 
a different approach is possible. In this case, as shown by Deuring [4], there is 
a Hecke character tp of F with values in K x such that for every prime of F 
where E has good reduction, ?A(^3) G K = End(E') Q reduces to the Frobenius 
endomorphism of E modulo ty. Thus if one can compute the Hecke character tp 1 
one can determine the number of points on every reduction of E, including the 
original curve E. If E is an ordinary elliptic curve over ¥ q , then E is always the 
reduction modulo of some CM elliptic curve E defined over some number field 
F. The field K determines the Frobenius endomorphism of E over F g up to a root 
of unity in K (generally ±1). The computation of the Hecke character of E can be 
viewed as the determination of this root of unity, for every prime of F. 

This CM approach has been carried out in special cases by several authors. The 
Hecke character of E was computed by Gross [U [7] when End(-E) is the maximal 
order in Q(- v / — p) with p prime and p = 3 (mod 4), and by Stark [26j when End(_E) 
is the maximal order in Q(v— a) with squarefree d = 3 (mod 4) and 3 \ d (i.e., 
d = 7 or 11 (mod 12)). Individual special cases were done earlier by a number of 
people, dating back to Gauss; see p. 349 of [12] for some of the relevant references. 
For further discussion of the history of this problem, see §5 of [21)] . 



This material is based upon work supported by the National Science Foundation under grants 
DMS-0457481 and DMS-0757807 and the National Security Agency under grants H98230-05-1- 
0044 and H98230-07-1-0039. 
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In this paper we complete this program by computing, for every imaginary qua- 
dratic field K, every imaginary quadratic order 0, and every number field F D K , 
the Hccke character of every elliptic curve over F with End(_E) = 0, thereby com- 
puting the number of points on the reductions of these elliptic curves. This extends 
the results of Stark and Gross to all d, including d = 1,2 (mod 4) and d = 3 
(mod 12), and to all orders, including non-maximal orders. Also, whenever d = 2 
or 3 (mod 4) , we produce a model of a Q-curve with CM by the maximal order in 
Q(V— d). (There are no Q-curves with CM by the maximal order in Q(^/—d) when 
d > 1 is a product of primes congruent to 1 (mod 4).) 

One motivation for studying this question comes from cryptography. For various 
cryptographic applications, such as finding "pairing-friendly" elliptic curves, one 
needs to find an elliptic curve over F p with a given number of points. The usual 
way to do this (the "CM method" [1] ) produces a CM elliptic curve over a number 
field whose reduction E/¥ p has the property that either E or its quadratic twist 
has the correct number of points. In 13] we use the results in this paper to give a 
simple efficient algorithm for determining which of the two elliptic curves is correct. 
This settles an open question of Atkin and Morain (Conjecture 8.1 of pQ). 

We now state our main result in the (useful) special case where j(E) — ](Ok): 
with Ok the maximal order (it follows that E has CM by Ok)- 

Theorem 1.1. Suppose E : y 2 — x 3 + ax + b is an elliptic curve over a number field 
F , and j(E) = j(Ok) where Ok is the ring of integers of an imaginary quadratic 
field K = d) C F, with squarefree d ^ 1,3. Suppose <P j 2 is a prime of 

F where E has good reduction. Let A € Ok be a generator of the principal ideal 
N F/K (^) and let q = N F/Q («P). Then 

#E(0 F /y) = q + 1 - W ■ e ■ Tr K /®(\) 

where 

(( 6j2 w A ) 2 */^ 3 ( mod4 )< 

W=\{ ~ m ^\ ifd^2 (mod 4), 

l( (6b)2 ° ,( g- 1728) ) 4 ifd=l (mod 4), 

the n-th power residue symbols (^-) G fi n and the Weber function 73 are defined 
in <2| below, is defined by 



d (mod 8) 


2 


3 


6 


7 


Zd 


J~d 


3+\/ = d 
2 


3 + V^d 


2 



and e is defined by: 



d=3 (mod 4): 



A 3 (mod 4) 


1,-V^d 


-l,V=d 


e 


1 


-1 



d= 2 (mod 4): 



A (mod 4) 


1, -1 + 2y/^d,±l + y/^d 


-1, 1 + 2y/^d, ±1 - V^d 


e 


1 


-1 
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d= 1 (mod 4): 



A (mod 4) 


l,l + 2V=d 


2 + y/^d 


-l,-l + 2i/=d 


2 - ^d,-^d 


e 


1 


i 


-1 


—i 



Our method of proof is similar to the method of Stark (55] , which follows an ap- 
proach used by Rumely in his thesis and [14] . Rumely showed how to use Shimura's 
Reciprocity Law (for values of modular functions at CM points) to compute the 
Hecke character of a CM elliptic curve in certain special parametrized families^ 
Rumely (Example 1 on p. 394 of [14]) and Stark (equation (3) on p. 1121 of [26] ) 
used Weber functions to write down a family E z of elliptic curves, parametrized by 
z in the complex upper half-plane f) (take a = 1 in Definition 12.41 below). When 
d = 3 (mod 4) and 3 \ d, then z € $j can be chosen so that E z has CM by the 
maximal order Ok of K — Q(y—a) and E z is defined over the Hilbert class field 
Hk of K, and in this case Stark computes the Hecke character of E z over Hk- If 
E is an arbitrary elliptic curve with CM by Ok over a number field F D K, then 
Hk C F and E is isomorphic to a quadratic twist of some such E z over F, so one 
obtains the Hecke character of E over F. 

If cither d is a multiple of 3 or d ^ 3 (mod 4), then there are z £ Sj such that E z 
has CM by Ok- For all such z, the curve E z is defined over a small but nontrivial 
extension of Hk- For arbitrary orders O there are z € fj such that E z has CM 
by O and E z is defined over a small extension H' of the ring class field Hq of 
O. If E is an elliptic curve with CM by O defined over a number field F D K , 
then E is isomorphic to some E z over Q, and F contains Hq but F need not 
contain H' . In order to compute the Hecke character of E over F, we need to 
determine what Gal(Q/ Hq) does to the torsion points of E z , not just the action of 
its proper subgroup Gal(Q/ H' ) on the torsion points. We do this in Proposition 
13. 3[ extending the Rumely-Stark method. This allows us to compute the Hecke 
characters for all elliptic curves with CM by O defined over F, for every d and O 
and every number field F D K. Our main results are Theorem 15.31 and Corollary 
15. 4( and the heart of the proof is in Theorem 14.41 

In [7] , Gross defined a Q-curve to be an elliptic curve that is isogenous to all of 
its Galois conjugates, and studied these curves in detail when they have CM. In [8], 
Gross exhibited equations for Q-curves with CM by the maximal order of Q(a/ — P) 
when p is a prime congruent to 3 (mod 4), and determined their Hecke characters. 
We use our Hecke character computations (Theorem I5.3j) to exhibit equations for 
Q-curves with CM by the maximal order of Q(\/—d) for all d = 2 or 3 (mod 4), 
and we use quadratic reciprocity over K to give another expression (Theorem 17. 4|) 
for the Hecke characters of these curves. When d = 3 (mod 4), the formula for the 
Hecke character in Theorem 17.41 is the one given by Gross (Theorem 12.2.1 of [7] 
and Proposition 3.5 of [H]) when d is prime and by Stark (Theorem 1 of 26J) when 
3 { d, while the formula in Theorems 11.11 and 15.31 is of a different form. 

In Example 14.31 we give a counterexample to the common myth that ip(^P) is 
necessarily in O, where ip is the Hecke character associated to an elliptic curve with 
CM by an order O. 



^Shimura points out in Remark 14.12(3) of 1241 that there is a gap in Rumely's proof of 
Theorem 1 of 1 141 , although the statement of that theorem is correct in the setting of Example 1 
of ) 141 . While our method was inspired by Rumely's approach, we do not use his results. 
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The reader who wishes to avoid technical details might prefer to start by reading 
the statements of Theorems [O] EH and 17.41 and Corollary 1 5. 4[ and referring back 
to the notation and supporting lemmas and propositions as necessary. 

Outline of the paper. In Sj2]we introduce notation, state Shimura's Reciprocity 
Law, and describe the setting in which we work. In §S] we state or work out 
the properties of the Weber functions and Dedekind's ^-function that we need to 
compute Hecke characters. In ffj] (Theorem l4.4l) we use these properties to compute 
the Heckc characters of the twists of E z mentioned above. In $5] we use Theorem 
14.41 to prove Theorem 15.31 and Corollarv l5.41 our main results on Hecke characters 
and point counting, and in §6 we compute and exhibit the tables of values of an 
important function that appears in our formulas in Theorem 15.31 and Corollary 
15.41 In Sj7]we obtain models for Q-curves and formulas for their Hecke characters 
(Theorem 17.41) . In fJ5]we give a point-counting result with a different flavor, under 
hypotheses that lead to a particularly simple statement. 

2. General notation 

In this section we give definitions and notation that will be used in later sections, 
and state Shimura's Reciprocity Theorem. 

Let $j denote the complex upper half-plane. Let i denote the square root of —1 
in f). For z £ Sj, let 

L z := Z + Zz, 
9 2{z):=m Yl u ^ and <?3(*):=140 ^ 

and let p(it; z) denote the Weierstrass p-function ofiteC for the lattice L z . 

Note that gk{z) is a modular form of weight 2k and level 1, with Fourier coef- 
ficients in (27rz) 2fe Q (see for example §2.2 of [22]). Let r\ denote the Dedekind eta 
function r\(z) := e 2 ™ 2 / 24 Il^Li(l ~ e 2lrmz ), and define the Weber functions 

72(z) := 12—- — n — and 73(2) :— — o 7- — . c . . ,„ . 
' v ' (2m) 4 7 1 (z) s ' v ; (27ri) 6 r/(z) 12 

Then rf (resp., ij 12 ) is a modular form of weight 4 and level 3 (resp., weight 6 and 
level 2) with Fourier coefficients in Q, and 72(2) and 73 (z) are modular functions 
of levels 3 and 2, respectively, with Fourier coefficients in Q. Let j(z) denote the 
usual j-function. Weber (see for example p. 326 of [16]) showed 

l2 (z) 3 =j(z) and 7 3 (z) 2 =^)-i728. (2.1) 

If F is a subfield of Q or is a local field, let Of denote its ring of integers. 

If F C C is a number field, let A^, denote its idele group, and let F ah denote the 
maximal abelian extension of F in C. If s 6 A£ let [s, F] € Gal(F ab / F) denote its 
global Artin symbol. If w is a place of F then F w will denote the completion of F 
at w, and if s S A^ then s w € F£ will denote the ui-component of s. 

By a prime of a number field F we mean a prime ideal of Of ■ If is a prime 
of F, let F ah,< $ denote the maximal extension of F in F ah that is unramified at 
*P, and if a € F x , let ord<p(a) be the power of *p in the prime factorization of 
the fractional ideal aOf. The Frobenius automorphism Frtp associated to ^3 is 
the unique a € Gal(F ab ^/F) such that a(x) = x N */^ (mod ^O f ^,v) for all 
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Let R + denote the multiplicative group of positive real numbers, let GL^ (R) 
(respectively, GL^(Q)) denote the subgroup of GL 2 (R) (respectively, GL 2 (Q)) of 
elements with positive determinant, and let GL^(Aq) denote the subgroup of 
GL 2 (Aq) consisting of elements whose oo-component has positive determinant. 
Let 

U = GL+(K) x ]JGL 2 (Z £ ) c GL+(A q ). 

l 

Recall that g = f ) e GL+(Q) acts on Sj by g(z) = ^f±f . 

Definition 2.1. Shimura (see [23] or §A5 of [2J; see also §6.6 of [22] or §1 of Q3]) 

defined an action of GL^ (Aq) on the space of modular forms / of weight k with 
Fourier coefficients in Q ab , for every fcGZ, characterized by: 

(i) the subgroup of GL^Aq) fixing / is open, 

(ii) f«(z) = (rfz + S)- k f(g(z)) for every g = (° f ) e GL+(Q), and 

(iii) if s G M+ x ]J e Zf and l(s) := (l s "i), then /'« = f^, where [s,Q] 
acts on / by acting on the Fourier coefficients. 

If K is an imaginary quadratic field and r S K n , let q T : K — > M 2 (Q) be the 
map defined by 

*w (i) - (";) ■ 

Then q T (K x ) C GL 2 (Q). Extend g r to a map <? r : A K ->■ M 2 (A Q ). Note that for 
all /x S A£ , 

det(? r f») = N K/Q ( M ) (2.2) 

so in particular det(g r (/i) 00 ) = /ioo/^oo > 0, and therefore g T (A^-) C GL 2 (Aq). 
The following theorem is Theorem 6.31(i) of [22] , 

Theorem 2.2 (Shimura Reciprocity). Suppose f is a modular function with Fourier 
coefficients in Q ab , K is an imaginary quadratic field, t ^ K D Sj, and f is defined 
and finite at r. Then f(r) € K ah , and if s € then 



/( T )[«.*] = /»rW- 1 ( r ). 
Let /Lt„ := {z G C : z" = 1}. 

Definition 2.3. Suppose F C C is a number field, /x„ C f, $ is a prime of F 
not dividing n, and a € i 7 ' x is such that n|ordsp(a). Then F(a 1 ^ 1 ) C F ah '^ and we 
define the n-th power symbol 

(*) n> , : = (« 1/ ") (Fr ^ 1) e m„. 

Note that if mln then (&) = (^^) . If further a e C F - 03, then 
F € /i„ is characterized by the congruence 

(!) = aPW^- 1 )/" (mod^p). 

When n = 2 this is the quadratic residue symbol, and it is 1 if a is a square in 
(Of/^) x and —1 if a is a nonsquare in (£>f/<P) x . 

If E : y 2 = x 3 +ax+b is an elliptic curve, its discriminant A(E) is — 16(4a 3 +276 2 ). 
By End(_B) we mean endomorphisms defined over an algebraic closure of the ground 
field. When E is an elliptic curve over C, let E[N] = {P £ E(C) : NP = O}. 
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Definition 2.4. When a G C x and z G Sj, define an elliptic curve over C: 

jp( a ) 2 3 272(f) , 373(f) 

Then: 

j(Fi a) ) = j(z), A(F z a) ) = a 6 , and End c (F z Q) ) = {A e C : XL Z C L z }. (2.3) 

When a = lwe will often write simply F z instead of -Ei . 

If K is an imaginary quadratic field, is an order in K, and £ is a rational prime, 
let Oe := 0®z2^. If s G A^-, let s<> denote the projection of s in (if ®q(Q>£) x C A£. 

Definition 2.5. Suppose if is an imaginary quadratic field, is an order in if, 
F is a finite extension of if, and ^3 is a prime of F. Let 

Vfc = {x G F x : ord«p(a:) = 1} C F x C A x . 

We define an (O, F)-good generator of N F / K (ty) to be an element A G K x such 
that 

A" 1 ^/^) C if * IJ^ X (2-4) 

t 

Lemma 2.6. Lei K, O, F, and *}3 be as in Definition \2.5[ If X is an (O, F)-good 
generator of Np/x{ty), then: 

(i) XeO K andXO K =N f/k {%), 

(ii) if u G 0]^, i/ien itA is (0, F)-good if and only if u € X , 

(iii) i/«Pt2, i/ien A G 2 x . 

Proof. Let p be the prime of if below *}3. Suppose q is a prime of if and t £ V<p. 
By ([231), ord q (A) - = ord q (N F/K (^)) if q ^ p, and ord p (A) = ord p (N f/K (i)) = 
OTd p (N F/K (<#)), so A0 K = Npy K (93), giving (i). If u G X , then clearly uA is 
(0, F)-good. Conversely, if A and A' are both (0, F)-good generators of N f /k (90 > 
then their ratio is in 0^ for every £, so it is in X . This gives (ii). Assume 5)3 \ 2. 
Then iV F/K (V%) G 2 . Thus by ([23), A € 2 , giving (iii). □ 

Remark 2.7. In general, an (0,F)-good generator of N F / K (^ji) may not exist. 
We will show in Corollary 14.21 below that if there is an elliptic curve E defined over 
F with CM by and with good reduction at 5)3, then N F/K {<#) has an (0,F)- 
good generator, and if further 5)3 does not divide the conductor of the order 0, 
then N F / K (y$) has an (0, F)-good generator in 0, and a generator of N F / K ($) is 
(0, F)-good if and only if it is in 0. By Lemma VIM \\). if K is not Q(i) or Q(\/^3) 
and there is an (0,F)-good generator of N F / K (^), then every generator of the 
ideal N F/if (Cp) is (0,F)-good. 

3. Some background results 

In this section we state or work out the properties of the Weber functions and 
Dedekind's ^-function that we need to compute Hecke characters. 

Fix an imaginary quadratic field if and fix r G H K. Let T be the order 
associated to the lattice L T = Z + Zr, i.e., 

O t = {a G if : aL T C L T }. 

The ring class field H T of T is the abelian extension of if corresponding under class 
field theory to the subgroup K X K* H t 0* t of A x . Then H T = K(j{r)) (see p. 23 
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of or Theorem 5.7 of 22J). If A G Q* e C A* theng T (A) € GL 2 (Zf) c GL^(Aq), 
and if s £ K*H e O* t then q T {s) G U. Note that s G K*l\ e O* e if and only if 
G Q* t for every i. 

Definition 3.1. Let <f> : SL 2 (Z/4Z) — > /i. 4 be the unique homomorphism that sends 
(o i) to z. We will also view as a homomorphism SL 2 (Z 2 ) — ► A*4 by composing 
with reduction modulo 4. We define a function S T : 0* 2 — > /i, 4 as follows. If 
A G <D* 2 then (J N(f/Q ° w -i )g T (A) € SL 2 (Z 2 ) by (O, and we let 

MA) = ^((JnJa)- 1 )«t(A)) g m 4 . 

Then <5 T (A) depends only on the reduction of A modulo 40 ri2 , so we will also view 
S T as a function from (e> Ti2 /4e> Tj2 ) x to/x 4 . Note that {0 Ta /iO Ta ) x = {O r /AO T ) x . 

Lemma 3.2. Suppose s G A^- is such that se € e for every rational prime I. 
Then 

fa^W) 8 = 6 T {s 2 )rf. 
Proof. Let p = rf, and for every g = ( " £ ) G SL 2 (Z) define by 

(p| s )(z) = ( 7 z + ( 5)- 3 p(3W). 
Then p is a modular form of weight 3 and level 4 with Fourier coefficients in Q, and 
Pig = ^(fl')p f° r every g G SL 2 (Z) (see for example §1 of [5]). 
Let 

V 4 = {veV:v 2 -(l1) G4M 2 (Z 2 )}, and (UJ,,-.). 

By (|2.2p . m-? r (s)eUn SL 2 (Aq), so by Lemma 1.38 of [22] we can write 

w ■ q T {s) = v ■ h (3-1) 

with ueUi and h E SL 2 (Z). Since the Fourier coefficients of p lie in Q, Definition 
HJlni) shows that p w = p. Since p has level 4, Proposition 1.4 of [23J shows that 
p v — p. Thus (using Definition 12. lf ii)) 

P 9t(s) = p w - qAs) = P v - h = P h = p\h = <t>{h)P- (3-2) 
Since 4>[h) — </>(w 2 <7t(s 2 )) = 5 T {s2), this proves the lemma. □ 

The next result is an application of Shimura's Reciprocity Law. Its proof is 
similar to Rumely's proof of part of Theorem 1 of [14] , 

Proposition 3.3. Suppose N G Z + . F is a finite extension of K, ^ is a prime of 
F not dividing 2N, and u € N~ 1 O t /O t . Then: 

(i) p'{u-T)/((2 m fn{Tf ) G F ab ^ } 

(ii) If X is an (O r ,F)-good generator o/N^y^CP), then 
P'(u;t) \ Fl ' v p'(Au;t) 



s T (\y 



,(27ri) 3 77(r)V rv ; (27ri) 3 r;(r) 6 ' 

Proof. For T G U, let T N denote the image of T in GL 2 (Z/A^Z). If (a,b) G 
(A r_1 Z/Z) 2 (viewed as a row vector), define 

p'(az + 6;z) 
/(«,&)(*) - (27r . )3 • 

Then (see §6.1 and §6.2 of [52], or p. 392 of [H]), 
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(a) f(a.b) is a modular form of weight 3 with Fourier coefficients in Q ab , 

(b) if T G U then (/ (Q , b) ) T = f(a.b)T N - 

Let p be the prime of K below <p, let p be the prime of Q below ^P, and write 
cit + b with a, 6 G ./V _1 Z/Z. Then f( a ,b)/ r f is a modular function with Fourier 



coefficients in Q ab , and 

p'(w;r) _ /(a,6)(r) 



(27ri) 3 ?7(r) 6 r)(r) e 
Suppose (ef^ and ord<p(i) = 1. View t G A F , and let s = A _1 N F/K (i) G A£. 
Since A is an (0 T ,F)-good generator of Npy#($JJ), we have s G II« ^*^> so 

?t(») e u. 

By Theorem E2 p'(u; r)/((27ri) 3 7 ? (r) 6 ) G if ab and 



{2TTi) 3 ri(T) 6 J \ t)(t) 6 J ( 7? ^W- 1 ( r ))6 ■ 

Let (a', b 1 ) := (a,b)q T (s) N 1 G (A^Z/Z) 2 . Since f AT, we have s e = A" 1 for all 
£\N, and so (^(s)^ 1 = q T (\) N . Thus in C/O r , 



a'r + b' = (a',b') Q =M)? r (»)^ Q 



(a,6)g T (A) Q = (a, 6) = Au. 



Using this and (b) above, 



(/(^))- W " l (r) = / (o , 6)#rW -i(r) - / ( ^)(r) = (3.4) 



Since *p f 2, we have S2 = A 1 , so by Lemma [ 

(fW"(r)) 6 = i T (A),(r) 6 
Combining this with (|3 . 3[) and (|3 .4[> immediately gives 



P ' (U;T) ^'^-MA)- 1 ^ - (3-5) 



(2 7 ri) 3 7 ? (r) 6 J TV y (27ri) 3 77(r) 6 ■ 

Since the right-hand side is independent of t (recall that s was defined in terms of 
t G Fsp ) , for every r G F ^ we have 

(2m) 3 7?(r) 6 U27ri) 3 »7(T) 6 / V (27ri) 3 77(r) 6 / 

Since {[r, F] : r G F m} is the inertia group at <P in Gal(F ab /F), it follows that 
p'(w;r)/((27ri) 3 7](r) 6 ) G F ab >^, giving^ Let L = K ah n F ab '^. By class field 
theory, 

[a,tf]| L - [N F/K (t),X]| L = [<,F]| L =Fr<p| L . 



This and (jnini) give (ii) □ 



Lemma 3.4. Let 13 G Z<o denote the discriminant of the order O t . Then: 

(i) 72(r) 3 ,73(r) 2 GQ0-(r))ciI T ; 

(ii) if D is odd then VTj^ 3 (t) G Q(j(r)) C iJ T and 73 (r) G iJ r ; 

(iii) i}D = 4 or 8 (mod 16) i/ien v^D73(t) G Q(j(r)) C i? T and 473 (r) G ff T ; 
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(iv) if D = or 12 (mod 16) then i £ H T . 



Proof. Part [(ij] follows from (|23]). Let oj = (3 + \AD)/2 if L> is odd, and oj = VD/2 
if D is even. Then L w = O t , so 7 3 (w) 2 = j(to) - 1728 and 7 3 (r) 2 = j(r) - 1728 
are Gal(_ff r /i ; i')-conjugates by Theorem 5.7 of [22]. Therefore it suffices to prove 
(ii), (iii), (iv) when r is replaced by lu. In this case all three statements (except 
D = — 8, which is easy to check) are proved by Birch in §6 of [5] (who in turn says 
that they were either proved or noticed by Weber in §§125, 126, 134 of [27]). □ 



4. Computing the Hecke character 

As before, fix an imaginary quadratic field K and fix r G f) n K. Theorem 14.41 
below is the key to our main results in $5] For example, when F = H T it allows us 
to compute the Hecke character of E^ over H T whenever E^ is defined over H T , 
even if a ^ H T (i.e., even if E T is not defined over H T ). We first state the basic 
properties we will need of the Hecke character. 

Proposition 4.1. Suppose E is an elliptic curve over a number field F D K, 
and O := End(_E) is an order in K . Let B be the set of primes of F where E 
has bad reduction, and let 1(B) be the group of fractional ideals of F supported 
outside of B . Then there is a unique character if) — ipE/F '■ 1(B) — > K x , called the 
Hecke character of E over F , such that for every prime *p of F where E has good 
reduction: 

(i) -0OP) G O k , and ip(<#) is an (0,F)-good generator ofN F/K (<#); 

(ii) if O — Z + cp t Ok, where p is the residue characteristic of and p \ c, 
then V>(<P) G 1 + cO K ; 

(iii) if ^ does not divide the conductor of O then ip(V) G C/ 

(iv) \E(O f /V)\ = N F/Q m + 1 - Tr K/Q (tl>(V))- 

Proof. Let ipj^ : A 2, — > C x denote the Hecke character of E over F on ideles, as 
defined in §7.8 of [22]. By Theorem 7.42 of [22 , Va is unramified at «p. Then 
?/>(*$) = ipA(t) where t G F^ c A F is any element satisfying ord<p(i) = 1. It 
follows from Proposition 7.40(ii) of [SJ that tp(^)/N F/K (t) G K£ He °e > so V>0P) 
is an (O, F)-good generator of N F / K (^ji) (in the sense of Definition ^. 5p . By Lemma 
l2"T6Ti1. we have ip(<$) € O k , giving (i). 

For (ii), we follow a standard method as in, for example, the proof of Theorem 
12 in Chapter 13 of [ID] . Let E denote the reduction of E modulo *}3, and let p be 
the rational prime below *}3. It is shown in the proof of Theorem 7.42 of [22] that 
the image of ip(^P) under 

K = O ® Q = End(£) ® Q ^ End(i?) ® Q 

is the Frobenius endomorphism <p G End(£J) C End(i?)£g>Q. Thus for every rational 
prime I ^ p, if Tf denotes the £-adic Tate module we have a commutative diagram 

T f (£) ® Q Tt ( E ) .g, q 
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where the vertical maps are induced by the reduction isomorphism Te(E) ^ Te(E). 
Since ip. € End(S), we have <p(T e (E)) C T e (E). Thus by Theorem 5 of [20], G 
On for all I ± p. Thus 

^W)eO K 0o e = Z + cO K . 

This gives (ii). If does not divide the conductor cp r of O (i.e., r = 0), then 
Z + cO K = Z + cp r O K = C, giving (iii). 



For (iv) see for example Corollary II. 10.4.1 of [25] for the case where O is the 



maximal order Ok, and see Theorem 7.42 of [22 for the general case. □ 

Corollary 4.2. Suppose that F is a number field containing K , *P is a prime of 
F , and O is an order in K . If there is an elliptic curve E defined over F with CM 
by O and with good reduction at <P, then: 

(i) N F / K (ty) has an (O, F)- good generator; 

(ii) iffy does not divide the conductor of the order O, then: 

(a) Np/ K {^) has a generator in O, 

(b) a generator of N pi a'(^P) is (0, F)-good if and only if it lies in O. 

Proof. By Proposition ^. If i). is an (P, -F)-good generator of N F / K (V), where 

ip is the Hecke character of E. If <p does not divide the conductor of O, then 
V'( < P) G O by Proposition 14. Q ui) . Part (b) now follows from Lemma [2T6l ii) . □ 

Next we give an example in which N f /k{^) has no generators in O, under the 
hypotheses in Corollary 14. 21 (and Theorem 15. 3j) . so ^ C- This is why we take 

an (C,F)-good generator of N F / K {ty), which always exists by Corollary 14.2( 1). 
rather than a generator in O. 



Example 4.3. Let K = Q(^f^Tl). Then O k = Z[(3] where j3 = (1 +_V Z TT)/2 G 
O k . Let O = Z + SO K , the order of conductor 3 in O k . Then 3 = 00, 



j(0) = j(3/3) = -18808030478336- 3274057859072 V33, 
and Ho = K(j(Oj) = K(V33) = K(y/^3). Let E be the elliptic curve 
y* + y = X *- _ (2487 + 433733)^ _ ^ _ 

Then E is defined over F := H a . Since j(E) = j(0), E has CM by O. The 
discriminant of E is the unit —23 — 4y / 33, so E has good reduction everywhere. 
Let be a prime of F above (3. Since is totally ramified in the extension F/K, 
we have N F / K {ty) = /30k, which has no generators in O. Therefore, "0(^P) ^ O. 
Note that the reduction of E mod *P has CM by O k . 

Recall S T from Definition 13.11 

Theorem 4.4. Suppose K is an imaginary quadratic field, r G n K , and 
O* = {±1}- Suppose F is a number field containing K, and a € C x is such 
that a 2 j2 ( T ), <3 3 73( r ) G F. Let ip be the Hecke character of E^*' over F. If is 
a prime ideal of F where E^ has good reduction, €p f 2 7 and X is an (O t , F)-good 
generator ofNp/Kity), then: 

(i) a 6 € F, 

(ii) 4 | ord<p(a 6 ) 7 

(iii) VOP) = ±A, and 
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(iv) VPP) = <5r(A)(a 9 / 2 )( F ^- 1 )A = 5 T (A)- 1 (a 3 / 2 )( Fr 'P- 1 )A. 

Proof. Let j = 72 = 72 (t), and 73 = 73 (r). Note that ff T = = 

K(j(Er)) C F. Since 7! and 73 S H T (by Lemma l3^fl T0 . and 7! and 73 cannot 



both be zero (by (|2.1| ). we have (i 



By ([231), End c (£;| Q) ) = O r . The map t : C/L T -> £^ a) (C) defined by 

t{u) = (ap(u;r)/((2 7 r J ) 2 ?7 (r) 4 ),a 3 / 2 p'(u;r)/((2 7 r l )^(r) 6 )) 

is an T -module isomorphism. Suppose N G Z + is prime to and suppose u G 
N'I-Ot/Ot = {C/O t )[N}. Then t(u) G f| q) [7V]. Since £^ q) has good reduction at 
and \ N, the coordinates of t(u) generate an extension of F that is unramificd 
at *p. By Proposition ^. 3^iJ| it follows that F(a 3 ^ 2 )/ F is unramified at <}3, and since 
(a 3 / 2 ) 4 = a 6 G F this proves (: 



By Proposition 7.40(2) of 22J, t(u) Fl f = t(tp(^)u). Taking ^-coordinates and 
applying Proposition I3.3f ii) gives 



3/2 p'(^(V)u;t) / 3/2 P'(u;r) \ Flv ( 3/2] Fr v , m -i p'(Mt) 

(27ri) 3 ?7(T) 6 \ (27Ti) 3 7/(T) 6 J 1 ^ Tl ' (27Ti) 3 ?7(T) 6 



so 

p'(^(^)u;r) = p'(Au;r)(a 3 / 2 )^- 1 )^(A)- 1 . (4.1) 

Since (|4.1[) holds for a dense set of u G C, it holds for every u G C by continuity. 
The left side of (|4.ip has poles exactly at all u G ^/>(^) _1 .L T while the right side has 
poles exactly at all u G \~ 1 L T . Thus -0CP)/A G 0* = {±1}, giving (hi). Since p' 
is an odd function, 

p^CP)«; r) = p'((^( $ P)/A)Au; r) = (^(<p)/A)p'(A U ; r) (4.2) 

for all u G C. Comparing this with (|4.ip gives 

^(«P)/A = ^(AJ-^a 3 / 2 )^*"^ G {±1}. (4.3) 



Since a 6 £ F by (i) we have (a 6 )( Frv ^ — 1 and thus 

^(ArV 72 )^" 13 =5 T (A)(a" 3 / 2 )^- 1 ) =5 r (A)(a 9 / 2 )^" 1 ). 
Combining this with (|4.3[) proves (iv). □ 

5. Explicit formulas for Hecke characters and point counting 

The main results of this paper are Theorem 15.31 and Corollary [531 
If K is an imaginary quadratic field and r G $jf~)K, let D(t) denote the discrimi- 
nant of the order O t (so D(t) = B 2 -AAC = or 1 (mod 4) where At 2 +Bt+C = 
with A,B,C eZ and gcd(A, B, C) = 1). 

Definition 5.1. With r as above and using S T of Definition 13.11 define a map 

6 T I {0 T /W T Y - M 4 by 



e T (A) 



' j (n k/ «(a)-i)/2 1 5 t ( A ) ifD(r)=4or8 (mod 16), 
5 T {\) otherwise. 



We will give e r in a concrete and explicit way in |£6j 

Recall the quadratic and quartic symbols \%j 2 p an d (|) 4J? of Definition 
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Remark 5.2. In Theorem 15 . 31 below, if K is not Q(i) or Q(V— 3), then by Lemma 
I2.6f ii) and Proposition I4.1f i), every generator of the principal ideal N F / K (^) is 
(O, F)-good. Thus in this case the hypothesis "let A be an (O, F)-good generator 
of Np/K^)" can be replaced by "let A be a generator of iVpy^CP)" . For arbitrary 
K, if <p does not divide the conductor of the order O, then by Corollary I4.2f ii). 
the hypothesis "let A be an (C,F)-good generator of iVp/^(<P)" can be replaced 
by "let A be a generator of N F / K {ty) in 0". The same simplifications apply to 
Corollary 15.41 

Theorem 5.3. Suppose E : y 2 — x 3 + ax + b is an elliptic curve over a number field 
F, and O :— End(F) is an order in an imaginary quadratic field K C F. Assume 
O x = {±1}- Take any r G 9) D K such that j(E) = j(r). Suppose *p is a prime of 
F, not dividing 2, where E has good reduction. Let A be an (0, F)-good generator 
of Np/ K ($l), let q — N f /q($$), let ip denote the Heche character of E over F, let 
D be the discriminant of O , and let j — j(r), 72 = 72(7"), and 73 = 73(7") (so 
O = Or)- Then: 

(i) If D is odd, then 73 S F, ordtp(6&73) is even, 

m) = (^) 2) ^r(A)A, 

and \E(O f /V)\ =q+l- (^) 2 F e T (\)Tr K/Q (\). 

(ii) If D = 4 or 8 (mod 16), then 173 G F, ord<p(— 66173) is even, 

m) = (^3) 2 ^ er( A)A, 

and \E{O f /<V)\ = Q+ 1 - (^P) 2 .^r(A)Tr K/Q (A). 

(iii) If D = or 12 (mod 16), then i € F, 4 | ord<p(6 2 & 2 (j - 1728)), 

and \E(0 F /n =q+l- ( 62fc2 ° y 1728) ) 4 F e T (A)Tr g/Q (A). 

Proof. The choice of r implies that O = O r - Let ^ = 2 7 3 4 a 2 6/(4a 3 + 27& 2 ) € F x . 
The map (x,y) 1— > ([j, 2 x, fj, 3 y) defines an isomorphism over F from E to the curve 
y 2 = x 3 + fi 4 ax + [i 6 b. The latter is 

yl = & _ 3 b 2 j3(j _ U28)x + l b 3 ji{j _ 1728)2j 

which is Ej- with a :— 667173, since 
j 3 =j= j(E) = 2 8 3 3 a 3 /(4a 3 + 276 2 ), 7^ = j - 1728 = -2 6 3 6 6 2 /(4a 3 + 27& 2 ). 

Thus E is isomorphic over F to E T a \ so they have the same Hecke character ip 
over F. Since j G F, we have H T <Z F. 

Case 1. Suppose D is odd. Then a 9 = 6 9 6 9 7 3 j 12 (j - 1728) 4 G F x by Lemma 
l3.4f iiL and ord<p(a 9 ) is even by Theorem 14.4( h). so 

(a9/2)(F , p -i) = { ^ kF = (5>1) 

Case 2. Suppose D = 4 or 8 (mod 16). Then za 9 = 6 9 6 9 i7 3 j 12 (j - 1728) 4 G F x 
by Lemma l3.4f iii). and ordsp(za 9 ) is even by Theorem I4.4f ii). If ( G /x 8 , then 
£(Fr„-i) = ^(g-i^ Thug; 

(a 9/ 9)( ft,-i) = ^-D/a^)^ = ,( 9 -D/ 2 (^) 2 ^ . ( 5. 2) 
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Case 3. Suppose D = or 12 (mod 16). Then 

a 18 = 6 18 6 18 J -24 (i _ 1728) 9 eF X ! 

i G F by Lemma GQJiv), and 4 | ordtp(a 18 ) by Theorem 14. 4f ii). It follows that 

(a9/2)(Fr ,-i) = f = ( ^-ms) ^ (g 3) 

The desired formulas for V'(^P) now follow from Theorem l4.4f iv) along with (|5.ip . 
pT2]) . (f5T3|l . and Definition O By Theorem jOJiii) , V0P)/A G {±1}, so 



Tr K/Q (V(*P)) = (^(q3)/A)Tr K/Q (A). 
The desired formulas for \E(Of/^)\ now follow from Proposition [4~1 fiv) □ 



Corollary 5.4. Suppose K is an imaginary quadratic field, re^fl if, and 0* = 
{±1}. Suppose F is a finite extension of H T and (3 G F x . With j :— j(r), 
72 := 72(^)7 o,nd 73 := 73 (r), Zet 6e i/ie elliptic curve given by the following table, 
depending on D{t) (mod 16) : 



D(t) 


E 


odd 


F (P<) . ?/ 2 _ T 3 /3 2 / , /3 3 73 / 
. y — J, 48 J- T g64 


4 or 8 (mod 16) 


F (/3*7 2 4 ) . ?; 2 _ „3 , /3 2 J 3 _ /3 3 *73i 4 
-^r £/ ' 48 864 


or 12 (mod 16) 


p(/97 2 4 73) . 2 _ T 3 /3 2 /(j-1728) /3V0-1728) 2 



Suppose ^ is a prime of F , not dividing 2, where E has good reduction. Suppose A 
is an (O t , F) -good generator of N F / K (^). Let q = Nf/q^P). Then: 

(i) _E is defined over F, End(_B) = O r , and j(E) = j ; 

(ii) if D(t) is odd or D(t) = 4 or 8 (mod 16), and -0 is f/ie Hecke character 
of E over F , then ord<p(/3) is even, V'(^P) = (m)2 jr^W^i arl ^ 

= 9+ 1 - (|) 2 F 6 T (A)Tr x/Q (A); 

(hi) if D(t) = or 12 (mod 16), and ^ is £/ie Hecke character of E over F, 
then 4 divides ord<p(/3 2 (j - 1728)), ^OP) = ( ^ (i y 1728) ) 4 F e T (A)A, and 

1*7(0^)1 = 9 + 1 - ( ^ (i y 728) ) 4 , F e T (A)Tr j , /Q (A). 

Proof. By LemmaEH ^ is defined over F. By ((231), j(E) =j= j(r), so End(#) = 
O t . Now (ii) and (iii) follow directly from Theorem 15.31 using the fact that 864 = 
6-12 2 . □ 

Remark 5.5. In Theorem 15. 31 we exclude the cases where O* is larger than {±1}. 
This excludes precisely those r with j(r) = 1728 (i.e., O t — Z[i]; i.e., D(t) = —4) 
or j( T ) — (i- e -> Cr = Z[e 2 ™/ 3 ]; i.e., -D(r) = —3). For completeness we include 
these cases in the next two results, which follow easily from classical results that 
go back to Gauss (see for example p. 318 of [3]). 

Theorem 5.6. Suppose F is a number field containing i. Suppose a G F x , and E 
is the elliptic curve y 2 — x 3 — ax. Let ip denote the Hecke character of E over F. 
Suppose *p is a prime of F, not dividing 2, where E has good reduction. Let A G Z[i] 
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be the generator of the principal ideal Np/Q^ffi) congruent to 1 (mod 2 + 2?), and 
let q = N F/Q («P). Then 4 | ord*p(a), 



-l 



m) = (# ) 4 , f a 



?d |£(0 F /<P)| = g+l-Tr 



Theorem 5.7. Suppose F is a number field containing \J— 3. Suppose b G -F x , 
and i5 is i/ie elliptic curve y 2 = x 3 + 16b. Let ip denote the Hecke character of E 
over F. Suppose is a prime of F, not dividing 6, where E has good reduction. 
Let A G Z[e 27 ™/ 3 ] oe the generator of the principal ideal ^f/q(^/^S) OP) congruent to 
1 (mod 3), and Zei g = N F /q(*P). TTien 6 | ordtp(6), 

md |S(0 F /*p)| = a+l-Tr K/Q ((A)-^A). 



6. Computing e T 



In order to make Theorem 15.31 and Corollary 15.41 explicit, it is necessary to 
compute the function e T . For any given r, this is a simple computation, following 
a method described (for example) in §1 of [9] (see the proofs of Lemma 16.11 and 
Proposition 16.21 below) . 

Suppose O is an arbitrary order in an imaginary quadratic field K and define 
Tp, as in (|6.2[) below. Proposition 16 . 21 below gives the explicit values of the function 
e TD . Suppose E is an elliptic curve over F D K. If j(E) = j(0) (= j(Tp>)), then 
Theorem 15.31 and Proposition 16.21 together give explicit formulas for the number of 
points on the reductions of E. When O = Ok, this gives Theorem ll.il Under the 
more general hypotheses in Theorem 15.31 (i.e.. j{E) = j(a) for a proper O-ideal a), 
take any r satisfying the conclusion of Lemma 16.4( 1) below. Then Lemma I6.4r ii) 
and Proposition 16.21 together give an explicit value for the e T (A) that occurs in 
Theorem 15.31 and Corollary 15.41 

Throughout this section, suppose D is the discriminant of an order O in an 
imaginary quadratic field K = Q(V^D) (i.e., D is a negative integer and D = or 
1 (mod 4)). Define a positive integer d by 



d = 



and let v — d denote the square root of — d in $j 
td € io n K by the following table: 



—D if D is odd 
—D/A if D is even 

Then K = 



(6.1) 



-d), and we define 



D : 


1 (mod 8) 


5 (mod 8) 


4 or 8 (mod 32) 


otherwise 


TD ■ 






3 + y/^d 




2 


2 


Or D = 


L TD = Z + 


Zt d and j(0) = j(r D ). 





(6.2) 



The function e T was defined in terms of the map <p of Definition 13.11 A strategy 
for computing values of <f> is given in §1 of [9j. We state the relevant ideas in the 
next lemma, and use them below. 

Lemma 6.1. Suppose M £ SL 2 (Z/4Z) and k G Z. Let C denote the commutator 
subgroup of SL 2 (Z/ '4Z). Then: 

(i) cj)(M) = i k if and only if (J ~ k )M G C, 

W <t>((- 10 1 )M(-l° 1 )- 1 )=m)- 
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Proof. The explicit description of C (see p. 498 of [9]) shows that (J {) gener- 
ates SL2(Z/4Z)/C. Thus, given M, there is a unique k G Z/4Z so that Mk ■= 
(I 1 k )M G C. Then 0(M fc ) = 1 (since fi 4 is abelian), so 4>{M) = i k . Now (i) fol- 
lows. Part (ii) follows from (i) and the fact that ( £ 1* ) ( ?) = ( V l ) ( o i ) • ° 

Proposition 6.2. The map 6 Td '. &2 — * 1^4 ^ given by the following tables. 



If D is odd: 



A 3 (mod 4) : 




-i,V = d 


e TD (A) : 


1 


-1 



If D = 4 (mod 16) : 



A (mod 4) : 


1, V^d, -1 + 2 V /Z d, 2 - v 7 ^ 


-1, -V^d, 1 + 2V=d, 2 + v 7 ^ 


£r D (A) : 


1 


-1 



IfD = 8 (mod 16) : 



A (mod 4) : 


1, -1 + 2^^, ±1 + v 7 ^ 


-l,l + 2 v /T d,±l-v / ^ 


e TD (A) : 


1 


-1 



If Dee 12 (mod 16) : 



A (mod 4) : 


l,l + 2 v /= rf 


2 + V^rf, v 73 ^ 


-l,-l + 2 v /= d 


2- v^d,-\^d 


e TO (X) : 


1 




-1 


—i 



If Dee (mod 16) : 



A (mod 4) : 


1,-1 + 2^^ 


±1 - 


-l,l + 2 v /T d 


±1 + v 7 ^ 


e TD (\) : 


1 


i 


-1 


—i 



Proof. Since e T is a simple modification of <5 T (Definition [jTTJ, it suffices to compute 
«y Tj3 (A). By Definition GTTJ 

^(A)=0((on a7q °(a)-O^(A)). (6.3) 

We follow the strategy for computing values of <p described in §1 of [9] (and Lemma 
16. II above). Find k G {0, 1, 2, 3} such that (J ~* ) ( n k/q °(a) _1 )#t d (A) is in the com- 
mutator subgroup of SL,2(Z/4Z) (given explicitly on p. 498 of 9J). Then S TD (A) = i k 
by Lemma l6~IT i) and (16. 3|) . We carried out this computation in Mathematica, and 
obtained the values in the tables. □ 

Remark 6.3. The discriminants of maximal orders in imaginary quadratic fields 
are exactly the negative integers D such that either D is squarefree and D = 1 
(mod 4), or D = — 4d with d G Z + squarefree and d = 1 or 2 (mod 4). So if D is 
the discriminant of a maximal order then D is odd or D eee 8 or 12 (mod 16). 

For x, y G Q, we write x eee y (mod 2 m ) to mean 0^2(2; — y) > m. 

Lemma 6.4. Suppose O is an order of discriminant D in an imaginary quadratic 
field K , E is an elliptic curve over C, and End(i?) = O. Then: 

(i) there is a r G f) H K such that j(r) = j(E) and r = rro + s with r, s G Q, 
r eee 1 (mod 2), and s = (mod 4); 
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(ii) with t as in (i), then for every A G C* 2 we have 

'e TD (A) ifr=\ (mod 4), 

e T (A) = { e TD (A)(-l)( NK /«( A )- 1 )/ 2 «/r = -1 (mod 4) and D = 4, 8 (mod 16), 



D (A) ifr=-l (mod 4) and D ^ 4, 8 (mod 16). 

Proof. By the theory of complex multiplication there is an invertible ideal a C O 
such that j(E) — j(a). Changing a in its ideal class if necessary, we may assume 
that [O : a] is odd. Let a be the smallest positive integer in a. Then a has a 
Z-basis {a, 6td + c} with a, 6, c € Z and bro + c G .f), and a, 6 must both be 
odd. Subtracting ca 2 from c if necessary, we may assume that 4 | c. If we let 
t = (b/a)T D + (c/a) G finK then L T = cr x a, so j(r) = j{L T ) = j(a) = j(E). This 
gives (i). Since j'(t) = j(E), it follows that O t = O {= O td ). 
By definition of q T , for every A G K x we have 

g T (A) = (6?) ?TD (A)(S?)" 1 - 
By Definition 13.11 and the fact that s = (mod 4), if A G 0* 2 ^en 

MA) = ^((oN K/Q VO(5l)?r D (A)(5?)- 1 ) 

= ^((5?)(oN K/ ir 1 )^W(5i)" 1 )- 

Thus 5 T (X) — S TD (A) if r = 1 (mod 4), and applying Lemma I6.1f ii) with M = 

(o n k/q °(a)- 1 )^d( A ) shows that ^( A ) = S rnW if »' = - 1 (mod 4). Part (ii) 
now follows from Definition 15.11 (and the fact that e ri) (A) G {±1} when D = 4, 8 
(mod 16)). □ 



7. Q-CURVES 

Suppose now that D is a (negative) fundamental discriminant, and let d G Z + 
be given by (|6.1|) and T£> by (|6.2p . Then d is a squarefree positive integer. With 
K := Q(\/^d), then TD = Ok is the maximal order of K, and H := i? TD is the 
Hilbert class field of K. Following Gross (§11 of [7]), an elliptic curve E over H is 
defined to be a Q-curve if E is isogenous over H to E a for all cr G Gal(H/Q). By 
Lemma 11.1.1 of [7], -E is a Q-curve if and only if for all but finitely many primes 
«P of H and all a G Gal(ff/Q), 

tP e ( < F t )=M%Y (7-1) 

where ipE is the Hecke character of £ over 7?. In Theorem l7.4l below we use Theorem 
15.31 to exhibit, whenever d = 2 or 3 (mod 4), explicit models and Hecke characters 
of Q-curves, defined over Q(j), with CM by Ok- When d is a prime congruent to 3 
(mod 4), Theorem 17.41 was proved by Gross (Theorem 12.2.1 of [7 and Proposition 
3.5 of [8]), and when 3 \ d = 3 (mod 4) it was proved by Stark (Theorem 1 of [26] ) 
(see Remark 17.51 below) . 

Remark 7.1. When all prime divisors of d > 1 are congruent to 1 (mod 4), there 
are no Q-curves with CM by O k ■ See Example 3 on p. 527 of [21] and §11.3 of [7]. 

We first need a lemma that we will use to prove Theorem 17.41 
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Definition 7.2. If F is a number field, q is a prime of F, and a, b € -F x , let 
[a, £>]q,F € {±1} denote the local Hilbert symbol at q, which is defined to be 1 if 
and only if b G N Fq(V ^ )/Fq (F q {^/a) x ). Let [a,b] 2 , F = Ilq^Mk-F- 

Lemma 7.3. (i) The function e TD : O k 2 ~* A*4 * s a homomorphism. 

(ii) If d = 3 (mod 4) and A £ Ok is prime to 2, then 

£ t d (A) = [^/-d,Xh,K- 

(iii) If d = 6 (mod 8), A € is prime to 2, and q — N^/q(A), then 

e TD (A) = (-1)(«-D(^+^)A6[^,A] 2 ,k. 

(iv) If d = 2 (mod 8), u, v G Z, A = tt + wV—rf is prime to 2, and q = N^-/q(A), 
then 

e TD {\) = (-l)(«-l)/2(_l)(9-l)(«+rf+3)/16[^Zrf )A] 



2, if ■ 

Proof. Part (i) can be checked directly using Proposition 16.21 It is easy to check 
that both sides of the displayed equations depend only on A (mod 80k), so (ii), 
(iii), and (iv) can also be checked by direct computations. □ 

Let j = j(j D ), 72 = 72 (td), and 73 = 73 (to). 
Theorem 7.4. Suppose d = 2 or 3 (mod 4). Let E be the curve 



'j£f^ a ).tf =x a + & x _*Gks£ lfd ^ 3 (mod4); 

:y 2 =x 3 -^x-t^ l fd^2 (mod 4). 



E = 

Then: 

(i) E is defined over 

(ii) j(.E) = j and A(E) = {-l) d d 3 j s . 

(iii) E is a Q-curve. 

(iv) Suppose ^ is a prime of H , not dividing 2, where E has good reduction. 
Suppose A = u + v«J—d € Ok is a generator of N ff /^(<p) ; with u, v € ^Z, 
and let q = Njj/q(*P) = u 2 + dw 2 . If d 3 then the Hecke character ip of 
E over H is given by 

f(f)A ifd = 3 (mod 4) 

■tj}($) = < (-l)(9- 1 )(9+ d + 11 )/ 16 (^ 5 )A z/d=6 (mod8) 

[(_l)(«-i)/2(_ 1 )(g-i)(g+d+3)/i6(_u_) A lfd = 2 (mod 8) 

where (-) is t/ie Jacobi symbol. 

Proof. Note that .E is the curve of Corollary 15.41 with (3 = \J — d. By Lemma 
l3~4Tii.iii) we have (i). By ([2~3]l and ([2~Tjl we have (ii). 

Suppose tp, A, q and u are as in |(iv)| By Corollary [5T4jii) (with (3 — y/—d), 

m) = (^Wr D (A)A. (7.2) 

We will evaluate ( jjp) 2 using quadratic reciprocity over if. 

Let p be the prime of K below and let / = [G H /<# : K /p], so XO K = 
Nh/a'CP) = P ■ By Proposition II.7.4.3(v,viii) of [5] and the product formula, 

{^\h = (^)lx = [^d^h,K=n^ p [V=d,\kK (7.3) 
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where q runs over primes of K. If q | 2d then q is unramified in Kd^f^d) 1 / 2 ) / K . 
Since ord q (A) = for all q ^ p, it follows from Proposition II.7.1.1(vi) of [5] that if 
q { 2pcZ then [\/— \]q,K — 1, so 

J][V^rf,A] q , A '= J] [^^^nRA],,^ (7.4) 

q#P q|d,qt2 q|2 

Suppose q | d and q { 2. Then A = u (mod qOi<" q ) and [-\/— d, A] q! K = ^, w]q,if ■ 
Further, q ramifies in K/Q, so if ^ = N^/Q(q), then 



the first equality by Proposition II.7.1.1(ii,iv) of [6j, and the second by Theorem 1 
in §111.1.2 of [19] (and the fact that u is a half-integer). Thus if d' is the largest 
odd divisor of d and t runs over primes of Q, then (|7.3p and (|7.4p yield 



q3 I2,H 



n 



fl,. 



q|2 



-d,X] 



'4u\ 



-d, A] 



2.if ■ 



Combining this with (17. 2| gives 

#P) = (f)[ 



-d, A] 2 ,xe ri) (A)A. 



Now (iv) follows from Lemma [773] 

To prove that E is a Q-curve, we need to check that (|7.1[) holds for all primes 
of .ff as above and all a E Gsl(H j K) . This is clear from the formulas of (iv) □ 



By Proposition l4T[riv)[ Theorem ITlfliv)] gives formulas for |i?(0A'/*P)|. 



Remark 7.5. Suppose that d 
the elliptic curve 



.4 



(V=3) 

TD 

i-Vd) 



2 or 3 (mod 4), and suppose that 3 \ d. Let A be 
if d = 3 (mod 4), 



y2 = x 3 + d£ x _ 



y 



48 
48 



864 
864 



if d ee 2 (mod 4). 



By §6 of [5] or Theorem 2 of [IB] , 72 S Q(j) (this is where 3 \ d is used), so A is 
defined over Q(j) and is isomorphic over Q(j) to the of Theorem 17.41 By (|2.3p 
and Lemma [3.4f i). j(A) = j and A(A) = —d 3 , and A is a Q-curve by Theorem 
I7.4f iii), When d is a prime p, A is the model given by Gross in [71 [5] for the Q-curve 
that he denoted A(p). When 3 \ d and d = 7 (mod 8) (resp., d = 3 (mod 8)), A is 
the curve E\ (resp., £Li) considered by Stark in Theorem 1 of 26J. 



8. Elliptic curves over F p with p = 1 (mod 4) 

Theorem 18.21 below, which uses Theorem I5.3[ gives a simple formula for the 
number of points on an ordinary elliptic curve E over ¥ p when p = 1 (mod 4) and 
Endj. p (£') = Q(v /=d) with d ee 2 or 3 (mod 4). 

We will use the following lemma, which is a variant of Deuring's Lifting Theorem. 

Lemma 8.1. Suppose p is prime, E is an ordinary elliptic curve over¥ p , andO := 
EndF p (£') is an order in an imaginary quadratic field K . Let H = K(j(0)). Then 
there are an elliptic curve £ over H and a prime ^ of H such that Oh/^P — ¥ p , 
End#(£) = O, j(£) — j(0), and the reduction of £ modulo is isomorphic to E 
over F D . 
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Proof. Since the proof is easy when j = or 1728, we can reduce to the case 
X = {±1}. Since E is ordinary, E has a canonical lifting £ C an to Q p (see Theorem 
3.3 on p. 172 of [H]), i.e., £ can is an elliptic curve over Q p that reduces to E, 
and EndQ p (£ C an) = EndF p (-E) = O. The action of EndQ p (£ C an) 011 the space f2 of 
holomorphic differentials induces an embedding K = EndQ (£ C an)®Q End(f2) = 
Q p . By the theory of complex multiplication (see Theorem 5.7(iii) of [22]), we can 
fix an embedding Q p <^-> C under which j(£ ca ,n) = j{0). Since K C Q p and 
j(0) = j(fca„) € Q P , we have ii = if (j(0)) C Q p . Let q? = ff n pZ p . Then <p is 
a prime of i? with residue field On/ty — ¥ p . Since £ can is a lift of 2?, j(O) = j(£ ca n) 
reduces to j(E) modulo ?p. 

Let A be an elliptic curve over H with j(A) = j(O). Then £ can is a quadratic 
twist of A by some S e Q p . Choose 8' e Q x so that u := 5'/<5 is in Z x and let £ be 
the quadratic twist of A by <5'. Then A(£) = u 6 A(£ can ), which is in Z x since £ can 
has good reduction at p. Thus £ is an elliptic curve over H with good reduction 
at q? and with j(£) = j(0). In particular, End#(£) = 0. Since the reduction £ 
of £ modulo q3 has j-invariant j(E), and Aut(-E) = X = {±1}, it follows that £ 
is a quadratic twist of E. Thus replacing £ by a quadratic twist ensures that £ is 
isomorphic to E over 0#/<p = F p . □ 

If a £ F x is a square, let (^) 4 be the quartic residue symbol defined by 

(|) 4 €{±1}, (f ) 4 = (modp). 

Theorem 8.2. Suppose p is prime, E is an ordinary elliptic curve over ¥ p , and 
:= Fiiidw p (E) is an order in an imaginary quadratic field K. Suppose further 
that p = 1 (mod 4), and the discriminant D of O is either odd and not —3, or is 
congruent to A or 8 (mod 16). Then: 

(i) the discriminant A(£J) of E is a square in F x , 

(ii) there are u,v € \l such that u 2 + \D\v 2 — p and A := u + v\/~D G 
satisfies 

A 3 = 1 (mod 40) i/ D is odd, 

(_1)(p-i)/4A =1 orl + VD (mod 40) if D = 4 (mod 16), 
A = 1 or -l + VZ) (mod 40) if D = 8 (mod 16), 

(iii) i/ u is as in (ii), then \E{¥ p )\ =p + 1 — 2( ^ ^u, 

Proof. Let j = j(0) and ii = K(j). Using Lemma 18. 1[ fix an elliptic curve 
£ : y 2 = x 3 + ax + b over H and a prime q? of H such that 0#/<p = ¥ p , j(£) = j, 
and the reduction of £ modulo *}3 is isomorphic over F p to E. Let p = *}3 n A". 
Since Oh/V — ¥ p , we have ^h/k{V) = P, so P 1S principal with a generator 
A = u + v\f~D E 0. In particular u 2 + \D\v 2 = N#/q(A) = p. Since p = 1 (mod 4), 
we have *P| 2. 

Suppose first that D is odd. Then (0/20) x S (0 K /20 K ) X has order 1 or 3, 
so A 3 = 1 (mod 20). Further, N^/q(A 3 ) = p 3 = 1 (mod 4). A straightforward 
computation shows that the only elements in (0/40) x that are 1 mod 20 and 
have norm 1 are ±1, so A 3 = ±1 (mod 40). Replace A by —A, if necessary, to 
ensure that A 3 = 1 (mod 40). 
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Now suppose D = 4 or 8 (mod 16). Since N^/q(A) = p = 1 (mod 4), a straight- 
forward computation in (0/40) x shows that A = ±1 or ±1 + \f~D (mod 40). Re- 
place A by —A, if necessary, to ensure that (— 1)(p -1 )/ 4 A = 1 or 1 + vD (mod 40) 
when D = 4 (mod 16), and A = 1 or -1 + \[D (mod AO) when D = 8 (mod 16). 
Note that if D = 8 (mod 16) then p = 1 (mod 8). 

Thus we have (ii). Note that if u',v' S \l> is another pair satisfying (ii), then 
u 1 + v ' \f~D G is a generator of a prime of K above p, so u' — ±u and v' = ±v. 
By the congruences on A in (ii), we have u' = u, i.e., the u satisfying (ii) is unique. 

Let td be as defined by (|6.2|) . We will apply Theorem l5.3l to S with r = to- Let 
v = 1 if D is odd, and i/ = i if Z) is even. By Proposition 16.21 e TD (A) = ^(p -1 )/ 2 
(we use here that p = 1 (mod 8) if D = 8 (mod 16)). By Theorem 15.31 since 
Tr^/ Q (A) = 2u, 

\E(¥ p )\ = \£(0 H m =p+l- 2 i >" 1 )/ 2 (^) 2U . (8.1) 

Note that (2 5 3 3 &) 2 /A(£) = j(£)-1728 = ±{v^) 2 . It follows from Lcmma[32fl;ii,iii) 
and p = 1 (mod 4) that modulo A(£) is a square and 

l ,(f- 1 )/ 2 (^m) 2 = ^-D/^efo^)^" 1 )/ 2 = (6 2 6 2 (j(^) - 1728))( p - 1 )/ 4 

= (2 12 3 8 6 4 /A(£))^ 1 )/ 4 ^ (^) 4 = (^) 4 . 

Since the outer terms are ±1, they must be equal. Now combine this with (|8.1[) . □ 

Remark 8.3. With notation as in Theorem 18.21 if E is supersingular rather than 
ordinary, and if further p > 5, then |_B(F p )| = p + 1. 
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